vinzenz/hyperhive
vinzenz/hyperhive
Watch
0
0
Fork
You've already forked hyperhive
 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

nix: address the swarm IdP by its domain, not by who runs it

Browse source 
`swarm.authelia.url` defaulted to `https://<domain>` only when this host
ran the container, and to `null` otherwise — so the address a client is
given was a statement about co-location rather than about the swarm. A
swarm has one SSO provider; every hive addresses the same name and
resolution decides which address that reaches, exactly as
`swarm.otel.domain` already works.

The option stays nullable: "this swarm has no IdP" is still expressible,
it is just now something an operator states rather than something not
running the container produces. The Grafana fixture that exercised the
no-IdP refusal says it explicitly.

Closes #4536
This commit is contained in:
atlas 2026-09-19 20:39:19 +02:00 • committed by mara
commit 4b6214305f
4 changed files with 61 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

5
nix/module-eval/grafana.nix
View file

@ -73,12 +73,17 @@ let
# The mirror image: the identity is placed, and the swarm names no IdP. The
# other half of "SSO must always be configured", and isolated the same way —
# exactly one thing wrong, so the arm reads one refusal.
#
# The null is now written out: `swarm.authelia.url` defaults to the swarm's
# IdP name on every hive, so "this swarm has no IdP" is a thing an operator
# states rather than a thing not running the container produces.
grafanaNoSso = hive {
deploy.grafana.enable = true;
deploy.grafana.plugins = [ ];
deploy.grafana.package = pkgs.emptyDirectory;
deploy.bao.clientCertFile = "/etc/pki/bao-client.pem";
deploy.bao.clientKeyFile = "/etc/pki/bao-client-key.pem";
swarm.authelia.url = null;
};
# Did ./host-modules/swarm-grafana.nix refuse this host, and for which of its